Hi Konstantin, If you have complete control over the client, then the JWT route may indeed be 'easier'. Until v5.3.7, one limiting factor was that all JWTs were created using a single set of signing & encryption keys. That implementation doesn't allow for JWTs to be distributed to many different 3rd parties, over which we have little control. Fortunately, v5.3.7 was re-architected to allow for per-service JWT keys, and this shouldn't be an issue any more.
Thinking about it for a moment: * Using a JWT 'freezes' into the two keys the method of establishing trust between parties. By that, I mean that you would have to re-configure CAS to use new keys *AND* then re-configure the client. * Using the CAS ServiceTicket method of establishing trust is more 'dynamic' as it requires the client to validate the ServiceTicket in each authentication session, but no re-configuration would be necessary if the keys were compromised. Kind regards, Drew On Wed, Feb 27, 2019 at 2:17 PM Konstantin <[email protected]> wrote: > We consider using CAS generated JWT instead of Service Ticket. We also > face a proxy like use case described here > <https://apereo.github.io/cas/5.3.x/installation/Configuring-Proxy-Authentication.html#use-case>. > Why > would we go into complexities of the CAS proxy call flow > <https://apereo.github.io/cas/5.0.x/protocol/CAS-Protocol.html#proxy-web-flow-diagram> > when > user facing service may simply supply JWT to the secondary service instead > of dealing with Proxy Ticket? Do we miss something here or indeed using JWT > makes handling the proxy use case much simpler? Thank you for sharing your > opinion. > > -- > - Website: https://apereo.github.io/cas > - Gitter Chatroom: https://gitter.im/apereo/cas > - List Guidelines: https://goo.gl/1VRrw7 > - Contributions: https://goo.gl/mh7qDG > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/fbb07e35-1c17-4485-9265-bf9453417dac%40apereo.org > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/fbb07e35-1c17-4485-9265-bf9453417dac%40apereo.org?utm_medium=email&utm_source=footer> > . > -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CACrophbSo-EsoVdVfnBco_-P7y3Hczp1dqoeVgRrLSTE8m12uw%40mail.gmail.com.
